Australia’s national health website has been hacked by an OpenAI agent. It was able to access non-public files and is the first publicly revealed case of an AI agent breaching the defences of a government portal.
Full details of the hack haven’t yet been revealed. But the essence of the incident, as outlined by Prime Minister Anthony Albanese, who is in New York for the United Nations General Assembly, is that on 18 June, an artificial intelligence agent belonging to OpenAI infiltrated the public-facing Medicare statistics reporting service portal. This includes aggregated statistics collated from individual medical services, such as from GP surgeries.
“‘The AI agent accessed both public and non-public files,” said Albanese on 23 September.
OpenAI said in a statement that it learned about the security breach during a review of “misaligned model activity”. The firm says its agents had been trying to look up statistics about Australia and then “took actions we did not intend”. It says it hasn’t found evidence of any patient data being accessed.
Though the company learned of the breach in August, it didn’t notify Australian authorities until 10 September, which it did by emailing a public government mailbox. It then took more than five days to reach the cybersecurity department.
“It took the company way too long to inform the government what had occurred, and the nature of the way that that notification occurred as well was unacceptable,” Albanese told reporters.
David Tuffley at Griffith University, Australia, says it isn’t the first time such a breach has occurred, even if it is the first government hack by an agent from a big AI firm to be made public, and it won’t be the last.
These agents don’t always stick to the rules, he says, as the Hugging Face incident earlier this year, where another OpenAI agent hacked into another AI company, demonstrates. “People throw up their hands in horror and say: ‘Oh no, it’s rogue AI.’ But it’s not, it’s really just AI doing what it was trained to do,” he says.
Failure to bring agents to heel should have criminal consequences, just as it would if it was a person who led the cyberattack, says Clément Canonne at the University of Sydney. “The issue with private data is once it’s leaked, it’s not going to come back.”